Splunk Search

Is there a permanent solution for handling too many search jobs found in the dispatch directory?

Engager

Hello.

I am getting this error:

Too many search jobs found in the dispatch directory (found=7079, warning level = 5000)

So I ran a script via CLI multiple times to delete all the search jobs in the dispatch folder, but it seems that it keeps repopulating back to ~7k search jobs the day after. Is there a permanent way to resolve this issue?
Thanks.

0 Karma

Community Manager
Community Manager

Hi @sunhoo

There have been several questions in the forum on this very topic lately, but one of them has been particularly helpful. Check out the answers by sowings_splunk and yannK in this post:
https://answers.splunk.com/answers/213571/what-causes-too-many-search-jobs-found-in-the-disp.html

Here's the page from Splunk documentation that covers maintenance of the dispatch directory by tuning the TTL for different search artifacts:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Dispatchdirectoryandsearchartifacts#Dispatc...

0 Karma